The FastMCP framework processes server names as parameters when installing command‐line interfaces. On Windows the install commands invoke subprocess.run() with a list argument, but the target CLI resolves to a .cmd wrapper that is executed by cmd.exe. When a server name contains shell metacharacters such as &, the flattened command string is interpreted by cmd.exe, allowing injected commands to be executed. This constitutes a CWE‑78 command‑injection vulnerability that can lead to arbitrary program execution on the host running FastMCP.

FastMCP, a framework maintained by jlowin, is affected in all releases prior to version 3.2.0. Servers running FastMCP that use the "fastmcp install claude-code" or "fastmcp install gemini-cli" commands with server names containing shell metacharacters are vulnerable. The vulnerability is limited to Windows platforms where the .cmd wrapper is used.

The vulnerability carries a CVSS v3 score of 6.7, indicating moderate severity. The EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not have known public exploits yet. An attacker would need the ability to supply or influence the server name used in the install command, which is typically a local configuration responsibility. If such control can be obtained, injected commands would run with the privileges of the FastMCP process, potentially elevating to full system compromise. The attack vector is local Windows command execution stemming from improper sanitization of input parameters.